WackoWiki 6.3.0 — Major Feature Release

This release represents a massive architectural overhaul, bringing modern JavaScript tooling, a completely rewritten editor experience, hardened security defaults, and a flexible new syntax highlighter.

Headline Features

WikiEdit: Complete Rewrite (ES2023 + ES Modules)

The editor has been modularized into ES6 modules with a dedicated state management layer and a AbortController for all fetch calls.

Dev Note: Complex legacy helpers (MarkUp, _LSum, _RSum, _TSum) have been refactored. Autocomplete selection bugs are fixed.

Security & Platform Hardening

• Content Security Policy (CSP) Nonces: All inline scripts now use strict nonces.
• Cookie Prefixes (RFC 6265bis): __Host- and __Secure- prefixes applied for session integrity.
• Native Clipboard API: Removed Clipboard.js dependency; uses modern navigator.clipboard with robust fallback.
• Fixed Invalid Selector Tokens: Patched potential broken "Copy to Clipboard" handlers.

Core Architecture & Routing

UI & Theming

• Dark Mode: First-class support with OS detection (prefers-color-scheme) and manual toggle.
• Double-Click Edit Comments: Rapid inline editing for comment sections.

Syntax & Markup Extensions

Phiki Highlighter (v2.2.0)

Replaces the legacy Pear highlighter. Fast, modern, supports 350+ languages via TextMate grammars.

Migration Required: Obsolete highlighters removed (css, ini, html, java, pascal, sql).
Action: Run the admin_replace action to auto-migrate:

%%(css)   →  %%(hl css) %%(sql)   →  %%(hl sql) ... etc 

Table Markup Improvements

New attribute system for rows, cells, and tables.

New Syntax:

!| col | col |!            # Header row with attributes #|(attr=value)             # Row attributes 

Supported Attributes:

CSS Selectors Added:

• .alternate — Zebra striping
• .sticky — Fixed header on scroll
• .default[left|center|right|top|middle|bottom] — Global cell alignment
• .colN[...] — Column N alignment (1–25)
• .col-N[...] — Column N from right alignment (1–9)

Helper Functions

• New table_attr() parser for the extended markup.
• Wrapper page now accepts col option.

Internationalization (i18n)

New complete translations added:

• 🇭🇷 Croatian (hr)
• 🇹🇭 Thai (th)
• 🇹🇷 Turkish (tr)
• 🇻🇳 Vietnamese (vi)

Dependency Updates

Upgrade Guide

1. Run Composer: composer install --no-dev (populates vendor/).
2. Run Migrations: Execute the installer script.
3. Migrate Highlighters: Run the admin_replace action to convert %%(lang) → %%(hl lang).
4. Check Routes: If you have custom handlers or pages named edit, show, properties, etc., verify they resolve correctly under the new page/_* namespace.
5. Clear Cache: Delete cache/config/ and cache/template/ (or run admincache action).
6. Test CSP: Verify your web server passes the Content-Security-Policy header with nonces.

Credits

Huge thanks to contributors for the Phiki integration, the translation teams for HR/TH/TR/VI, and everyone testing the WikiEdit rewrite.

Full Changelog: 6.2.1...6.3.0
Documentation: wackowiki.org

Minor feature and bug fix release for 6.2.x series

• extend table markup allowing table caption, cell spans, width and cell attributes
  • ?| table caption |?
  • ^| header | cell ||
  • || cell ^ header ||
  • ||(attr=value) cell | cell ||
  • attributes:
    • align = [center|left|right|justify]
    • bgcolor = [blue|red|green|x11colors]
    • colspan = number
    • id = id_name
    • rowspan = number
    • scope = [row|col|rowgroup|colgroup]
    • valign = [top|middle|bottom]
    • width = number[px|%|em|rem]
• allows now [px|%|em|rem] with wrapper_width
• change markup syntax for subscript to ,,subscript,,
• make sess->date_pattern dependent on $this->user_lang
• x11colors.css
  • replace .mark-[blue|green|red] with [xblue|xgreen|xred] to not overwrite default definitions in wacko.css
• miscellaneous minor fixes
• Libs
  • PHPMailer 7.0.2

Full Changelog: 6.2.0...6.2.1

Major feature release

• SQLite support
  • add DbSqlite class
  • add backup & restore in admin panel for SQLite
  • rewrote SQL queries to work with MySQL as well as SQLite
  • register custom regexp function to use REGEXP with SQLite
  • add functions to abstract SQL syntax and function differences between MySQL and SQLite
    • utc_dt()
    • date_sub(int $value, string $interval)
    • binary()
    • collate()
    • limit()
• fix missing route case for CSS files in RECOVERY_MODE
• validates the namespace to prevent users from creating inaccessible pages when mode_rewrite is enabled
• add binary string search action (see community folder)
  • adds exact or regex search for registered users
• installer
  • add SQLite table creation script
  • add _t() function for $lang[] array
    • installer uses now English as fallback for missing message sets
  • add mandatory installer password protection
    • It is imperative to set the password for the installer in the config/lock_setup file.
  • add new system page with whatsnew action
  • add private system page with with the admincache and admin_recovery action and set it as bookmark for the admin
  • the installer sets now bookmarks for the admin account, therefore it no longer shows the default bookmarks for the admin in the menu by default
• actions
  • menu: fix not showing 'Set a bookmark' form
  • whatsnew:
    • add filter for pages, comments and files
    • show also edited comments in list
  • no longer use link table for mostcommented and mostpopular action
• miscellaneous minor fixes
• WikiEdit
  • replace var with const and let
• update libs
  • php-diff 2.5.0
  • PHPMailer 7.0.1
  • PHP Thumb Library 2.3.3
  • SimplePie 1.9.0

Full Changelog: 6.1.29...6.2.0

Minor feature and bug fix release for 6.1.x series

• removed deprecated Pragma: no-cache and Expires: header
• fixes If-Modified-Since conditional requests issues
• fixes invalid ETag
• fixes various Cache-Control header issues
• fixes missing height width value for external img links
• adds option to transliterate filenames to lowercase
• adds navigation action
• adds option to set the SameSite attribute , see constants.php
• adds option login_notice to hide recurring 'Welcome back' notice
• adds full words highlight mode
• miscellaneous minor fixes
• update libs
  • PHPMailer 6.9.1
  • svg sanitizer 0.18

Full Changelog: 6.1.24...6.1.25

Minor feature and bug fix release for 6.1.x series

• adds file_meta for file_cache
• uses :focus-within pseudo selector for dropdown
• adds CSS class btn-sm and btn-md
• English message sets fixes
• initial language files for Tamil
• re-check for anonymous user before storing cache
  • soft_login() may set sess->user_profile
• removes redundant setlocale() call
• adds db_vendor to primary config
• installer auto-detects db_vendor
  • either mariadb or mysql
  • uses server SQL mode for installer by default
  • in debug mode the db_vendor can be selected in the db config page along with the SQL mode
  • mainly to solve SQL mode incompatibilities between MariaDB and MySQL
• renames sql_mode_strict to sql_mode
  • 0 - server (default)
  • 1 - session lax
  • 2 - session strict
• fixes not showing read ACL $ pages in the default menu for logged in users with no own bookmarks defined
• miscellaneous minor fixes
• update libs
  • svg sanitizer 0.19
  • PhpThumb 2.3.1

Full Changelog: 6.1.25...6.1.26

show_access_mode: show permissions link only for page owners The badge now renders as an <a> only for owners and admins; everyone else gets an inert <span>. Previously the method always emitted the link, so users saw a clickable "permissions" badge that took them to a handler they could not use. Also: type-hint parameters, replace the if/elseif chain with match, and hoist the "private" condition.

form_open: persist $href_param as hidden inputs on GET forms Adds a $persist_params flag (default false) to form_open. When set on a GET form whose $href_param is an array, each entry is rendered as a hidden input so the parameters survive submission without appearing in the URL. Values are escaped with Ut::html(); callers must keep $href_param entries scalar.

minor fixes

fix(installer): prevent orphan menu records when page_id is missing The installer could insert empty/orphan rows into the {prefix}menu table when the correlated sub-select for page_id returned NULL or 0. This happened when sanitize_page_tag() produced an empty tag, or in the multi-language SET_MENU_ONLY path over a missing page row. Changes in setup/insert_pages.php (insert_page function): - bail out early when the tag sanitizes to an empty string, avoiding any downstream INSERT for unusable tags - add a $menu_guard() closure that re-runs $page_select before each menu INSERT and silently skips it when the page row cannot be found - apply the guard inside all three driver branches (mysqli, sqlite, PDO) using the existing query idioms - no prepared statements, no try/catch, no schema changes - execution loop and query strings otherwise unchanged Mirrors the existing $add_page / $page_exists detection pattern so the patch stays consistent with the legacy installer style.

Fix SQLite FTS5 syntax error on special characters in search The full-text search query for SQLite used the user-supplied phrase directly inside an FTS5 MATCH clause. Characters such as "/", "-", ":", or "&" are treated as FTS5 operators/delimiters, which caused queries like `vendor/bin/phpunit` to fail with: fts5: syntax error near "/" Wrap the phrase in double quotes (and escape internal quotes by doubling them) before passing it to MATCH. This forces FTS5 to treat the value as a verbatim phrase, leaving LIKE-based fallbacks and the MySQL path untouched.